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ABSTRACT 


A  reliability-prediction  program  was  conducted  by  AR1NC  Research  Corporation  to 
provide  the  U.S.  Army  Mobility  Equipment  Research  and  Development  Center  with 
quantitative  reliability  predictions  of  two  manufacturers’  organic  Rankme-cvcle  engine 
generator  systems  and  a  computer  program  for  calculating  the  predictions.  Historical  failure 
data  were  compiled,  and  a  reliability -prediction  mathemnMcal  mode!  was  developed.  A 
computer  program  was  developed,  and  reliability  predictions  were  made  for  the  two  systems 
for  a  variety  of  missions  and  environments. 


FOREWORD 


This  report  was  prepared  by  AR1NC  Research  Corporation  for  the  U.S.  Armv  Mobility 
Equipment  Research  and  Development  Center,  Fort  Belvoir.  Virginia,  under  Contract 
ua  AR01-/0-D-4 142.  Its  purpose  is  to  provide  a  quantitative  reliability  assessment  of  engine 
generator  systems  currently  being  developed  by  Fairchild  Hiller,  Stratos  Division  and 
thermo  Electron  Corporation. 


v 


SUMMARY 


INTRODUCTION 

This  report  oresenu*  the  results  of  a  reliability -prediction  program  for  closed  organic 
Rankine-tycle  engine  generator  sets.  The  program  was  conducted  by  ARINC  Research 
Corporation  for  the  L'.S.  Army  Mobility  Equipment  Teseaieh  end  Development  Cents’*, 
during  the  periocKIuly  1970  to  September  1970. 

The  Rankine-cyde  generator  systems  r,f'  two  manufacturers  —  Fairchild  liiiler,-  Stratos 
Division,  and  Thermo  Electron  Corporation  —  are  considered  m  this  report.  Each  is  a 
self-contained  integrally  started  power-generatin'  system  capable  of  -  dht  hours’  operation 
on  its  own  fuel  supply.. 


RELIABILITY-PREDICTION  MODEL 

In  preparation  for  developing  the  prediction  model,  parameters  that  define  the  systems 
were  specified,  together  with  the  missions  and  environments.  The  reliability  block  diagran  s 
and  prediction  equations  (mathematical  model)  were  formulated  from  system  fvrctictnd 
schematics,  drawings,  and  diagrams. 


FAILURE  DATA 

A  number  of  failure-rate  data  sources  were  surveyed  and  the  failure  rates  for  similar 
components  listed.  Operational  factors  required  to  adjust  each  failure  rate  to  the 
environmental  modes  and  manufacturers’  estimates  were  derived.  A  Failure  Mode  and 
Effect  Analysis  (FMEA)  was  also  performed. 


COMPUTER  PROGRAM 

A  computer  program  depicting  the  mathematical  prediction  model  was  prepaied.  This 
program  can  be  exercised  for  any  basic  series-constructed  system  over  a  wide  range  of  time. 
The  output  (reliability  predictions}  can  be  obtained  for  a  variety  of  mission  types  over  four 
operating  environments.  The  program  was  made  sufficiently  flexible  to  allow  system- 
configuration  changes,  as  well  as  failure-rate  distributions  other  than  the  assumed  constant 
failure  rate. 


FLUIDIC-CONTROL  APPLICATION 

Th»-  feasibility  of  utilizing  fluidic  control  devices  was  investigated  briefly.  The 
advantages  and  disadvantages  of  such  devices,  their  estimated  reliability,  and  areas  of 
application  were  evaluated. 
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CHAPTER  ONE 
INTRODUCTION 


Under  Contract  DAAX01-70-D-4142  to  the  U.S.  Army  Mobility  Equipment  Command, 
ARINC  Research  Corporation  assessed  the  relative  effectiveness  of  two  organic  Rankine- 
cycle  power  plants  under  development  for  the  Electrotechnology  Laboratory  at  the  U.S. 
Army  Mobility  Equipment  Research  and  Development  Center  (USAMERDC).; 

The  purpose  of  the  assessment  was  to  make  quantitative  reliability  predictions  for  the 
two  candidate  configurations  and  to  provide  USAMERDC  with  the  basic  tools  for 
performing  future  reliability  analyses.  A  hypothetical  system  with  idealized  characteristics 
was  used  to  show  the  ultimate  reliability  of  the  Rankine-cycle  power  plant.  The  following 
tasks  were  performed: 

•  Review  available  information  on  the  Rankine-cycle  power  plants  and  establish 
baseline  data 

•  Identify  a  representative  mission  and  define  system  failure 

••  Perform  a  Failure  Mode  and  Effect  Analysis 

•  Develop  a  reliability-prediction  model  at  the  major-component  level  sufficiently 
flexible  to  permit  configuration  changes  and  the  use  of  various  types  of  failure 
distributions 

Perform  a  reliability  prediction  of  the  two  candidate  systems  and  a  hypothetical 
system 

•  Develop  an  estimate  of  the  mean  active-repair  times  for  the  candidate  systems  and 
determine  the  availability  of  the  systems 

This  report  presents  a  background  discussion  and  description  of  the  candidate  systems. 
Failure  Mode  and  Effect  Analyses  for  the  systems,  the  prediction  model  and  the  predictions 
themselves,  and  a  discussion  of  'be  application  ot  fluidic  controls  to  the  Rankine-cycle 
engine.  The  conclusions  and  recommendations  resulting  from  the  study  are  aiso  presented. 
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CHAPTER  TWO 


BACKGROUND 


The  U.S.  Army  is  currently  conducting  a  technical  evaluation  of  silent  ground-power 
systems.  The  Rankine-cvcle  engine  is  one  of  the  candidate  prime  movers  for  such  a  system. 
Two  contracts  to  develop  a  Rankine-cycle  engine  generator  set  were  awarded  by  the  U.S 
Army  Mobility  Equipment  Research  and  Development  Center  (USAMERDC),  Ft.  Belvoir, 
Virginia,  to  Fairchild  Hiller  Stratos  Division,  Bay  Shore,  New  York,  and  Thermo  Electron 
Corporation,  Waltham,  Massachusetts. 

The  closed  Rankine  cycle  for  steam  or  organic  working  fluids  involves  the  four 
theimodynamic  processes  shown  in  the  pressure-volume  (PV)  and  temperature-entropy  (TS) 
diagrams  of  Figure  1. 

Ideally,  the  working  fluid  undergoes  an  isothermal  and  isentropic  pressure  increase  in 
the  feed  pump,  process  1—2;  and  a  temperature  increase  in  the  boiler  at  constant  pressure, 
saturating,  evaporating,  and  superheating  the  fluid,  process  2—3,  Process  a— 4  represents  an 
isentropic  pressure  decrease  in  the  engine;  and  process  a— 1  is  the  constant-pressure  heat 
transfer  in  the  condenser,  condensing  the  vapor  back  to  a  liquid  to  re-enter  the  feed  pump. 


Figure  1.  RANKINE  CYCLE  PV  AND  TS  DIAGRAMS 
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P8E!EDIHS  PACE  BLANK 


The  organic  Rankine-cycle  systems  have  a  potential  problem  area  with  the  organic- 
fluids.  If  overheated,  the  fluids  undergo  thermal  decomposition,  rendering  the  system  use¬ 
less. 

Figure  2  is  a  flow  schematic  for  a  basic  Rankine-cycle  engine  generator  set  that  uses  an 
organic  fluid  as  the  working  substance.  The  numbers  correspond  to  the  processes  in  the 
cycle.  The  regenerator  is  used  to  increase  the  efficiency  of  an  organic  Rankine  cycle.  The 
energy  of  the  superheated  exhaust  vapor  is  transferred  internally  in  the  cycle  to  the  working 
fluid  after  the  fluid  leaves  the  feed  pump;  this  significantly  reduces  the  energy  required  to 
vaporize  or  superheat  the  fluid  in  the  boiler. 
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CHAPTER  THREE 

RELIABILITY-PREDICTION  MODEL 


The  term  “reliability  prediction  model”  describes  the  block  diagrams  and  equations  that 
depict  and  mathematically  relate  component  reliabilities  to  overall  system  reliability.  The 
development  of  a  reliability-prediction  model  encompasses  several  tasks: 

Definition  of  the  system  mission 

•  Definition  of  system  failure 

•  Statement  of  assumptions 

•  Development  of  reliability  block  diagrams 

•  Development  of  reliability-prediction  equations 

3.1  SYSTEM  DEFINITIONS 

The  two  manufacturers’  systems  are  similar.  The  major  difference  that  might  affect 
reliability  is  in  the  power  output  level  of  the  generator  sets,  which  affects  set  size.  The 
following  system  descriptions  show  the  differences  between  the  manufacturers’  designs. 

3.1.1  Fairchild  Hiller,  Stratos  Division  System 

Fairchild  Hiller  Stratos  D'vision,  hereinafter  called  STRATOS,  is  designing  a  1.5-kW 
organic  Rankine-cvcle  engine  generator  set  rated  at  28  Vdc.  The  set  will  be  inaudible  at  100 
meters,  will  weigh  approximately  150  pounds,  and  will  measure  approximately  2’  X  2'  X  2'. 

Figure  3  is  a  flow  schematic  of  the  STRATOS  generator  set.  The  organic  working  fluid 
is  FC75.  To  protect  against  overheating  or  overpressurization,  a  thermal  sensor  is  placed  at 
the  fluid  exit  point  on  ine  boiler  to  shut  the  system  down.  A  pressure-burst  disc  is  also 
placed  in  th*»  fluid  loop  for  additional  protection  of  the  system  components  in  case  the 
thermal  sensor  fails  and  the  system  becomes  overpressurized  to  the  point  of  catastrophic 
line  or  component  rupture. 

The  turbo  alternator  pump  is  the  unique  component  in  the  STRATOS  generator  set.  It 
combines  three  components  into  one  on  a  single  rotating  shaft.  The  two  fluid-film  journal 
bearings  and  a  thrust  bearing  are  lubricated  by  the  working  fluid.  The  unit  is  hermetically 
sealed  in  the  Fluid  loop,  two  fluid  drains  in  the  alternator  case  remove  entrapped  FC75. 
Liquid  FC75  flows  in  a  coil  around  the  alternator  portion  of  the  turbo  alternator  pump  to 
cool  the  windings.  The  power-conditioning  circuits  are  mounted  on  a  cooling  plate  for  the 
same  purpose.  This  keeps  all  of  the  major  power-producing  elements  at  a  constant 
temperature  during  system  operation. 
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Figure  3.  STRATOS  ENGINE  GENERATOR  SET 
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The  condenser  fan  and  the  fuel  pump  are  driven  by  variable-speed  motors.  The  motor 
speeds  are  adjusted  by  thermal  sensing  circuits  to  maintain  constant  fluid-loop  conditions. 

The  alternator  speed  is  kept  constant  by  a  solenoid  modulation  valve  in  the  fluid  loop 
just  prior  to  the  turbine  inlet.  The  valve  is  controlled  by  a  circuit  that  detects  the  output  of 
the  alternator  and  sends  a  signal  to  the  solenoid  to  vary  the  flow  rate  to  the  turbine.  The 
feed  pump  is  a  centrifugal  noncavitating  pump  whose  output  is  kept  constant  by  the 
alternator's  fixed  RPM, 

1  ne  fluid  loop  is  hermetically  sealed.  It  is  therefore  repairable  only  at  the  depot  level. 
Most  support  components  in  the  systems  (see  Chapter  Two)  are  repairable  at  the 
organizational  levei  of  maintenance.  The  electrical  and  electronic  circuits  are  currently 
planned  to  be  field-  or  depot-repairable. 

3.1.2  Thermo  Electron  Corporation  System 

Thermo  Electron  Corporation,  hereinafter  called  TECO,  is  designing  a  3-kW,  120-Vac 
Rankine-cycle  generator  set.  it  will  be  inaudible  at  100  meters,  weigh  approximately  300 
pounds,  and  measure  approximately  2.5  X  2.5'  X  2.5'.  Figure  4  is  a  functional  schematic  of 
the  TECO  generator  set. 

CP34,  an  organic  substance,  is  used  as  the  working  fluid.  To  protect  against  overpressure 
or  temperature,  safety  sensors  are  placed  in  the  fluid  loop.  The  boiler  requires  a  buffer  fluid 
around  the  organic  fluid  because  of  the  extreme  temperatures.  The  buffer  fluid  transfers  the 
thermal  energy  to  the  working  fluid.  The  flow  energy  of  the  vapor  is  converted  to  rotary 
motion  in  a  reciprocating  two-cylinder  engine  that  is  coupled  to  the  alternator.  The  vapor  is 
then  exhausted  through  the  regenerator  to  the  condenser.  A  positive-displacement  piston 
feed  pump  is  gear-driven  off  the  engine;  it  is  located  upside-down  to  form  the  bottom  of  the 
engine  crankcase.  The  crankcase  is  filled  with  a  silicone  lubricant  to  lubricate  both  the 
engine  and  the  feed  pump.  The  silicone  is  miscible  with  the  CP34;  a  fluid/lubncant  separator 
is  thus  necessary  in  the  loop  since  the  seals  and  rings  in  the  engine  and  feed  pump  are  not 
100-nercent  leakproof.. 

When  the  system  is  not  in  use,  the  working  fluid  and  lubricant  characteristically  migrate 
to  the  engine  crankcase.  A  starting  fluid  reservoir  is  placed  in  the  loop  to  drain  the 
accumulated  fluid  from  the  engine.  This  reservoir  provides  the  fluid  to  the  start  pump, 
preventing  pump  cavitation  at  system  startup, 

A  motor-driven  throttle  valve  is  used  to  maintain  constant  engine  speed.  Alternator 
output  is  sensed  by  a  speed-control  circuit,  and  a  control  signal  is  sent  to  the  valve’s  driving 
motor. 

The  fluid  loop  is  hermetically  sealed,  except  for  the  shaft  seal  on  the  engine  crankshaft 
which  mu^t  penetrate  the  crankcase  to  connect  to  the  alternator,  making  it  extremely 
impractical  for  the  user  or  field-support  maintenance  facilities  to  repair  components  in  the 
loop.  Most  of  the  ‘'lectrica!  and  electronic  components,  fuel-  and  air-supply  components, 
and  condenser  fan  are  planned  to  be  field-repairable. 

3.2  SYSTEM  MISSIONS 

The  U  S.  Army  Mobility  Equipment  Research  and  Development  Center  has  established 
a  goal  of  a  95-percent  reliability  for  the  generator  sets,  with  a  confidence  level  of  90 
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Figure  4.  TECO  ENGINE  GENERATOR  SET 


percent,  for  a  mission  duration  of  24  hours  and  an  inherent  availability  of  9S  percent. 
ARINC  Research  Corporation  used  this  requirement  as  a  basis  for  developing  two 
representative  missions. 

3.2.1  Mission  Profile 

3.2. 1.1  Mission  I 

The  first  mission  is  for  the  Rankin  e-cycle  generator  set  to  start  up  in  three  minutes 
(0.05  hour)  and  continuously  deliver  power  for  24  hours  without  shutting  down.  It  is 
con  reeled  to  an  external  fuel  tank,  but  this  fuel  source  is  not  considered  in  the  reliability 
model. 

3.2. 1.2  Mission  II 

The  second  mission  involves  cycling  the  generator  set  through  startup  and  power 
delivery  four  times  in  100  hours.  Two  of  the  startups  are  hard  starts,  requiring  six  minutes 
(0.1  hour)  each;  the  other  two  starts  require  the  normal  three  minutes.  The  sets  deliver 
p  rwer  continuously  for  25  hours  after  each  start. 

3.2.2  Environments 

At  *he  beginning  of  the  project  it  was  planned  to  incorporate  the  effects  of  temperature 
and  weather  conditions  as  the  environmental  effects  on  the  system.  It  became  apparent, 
however,  that  there  was  little  operational  information  on  mechanical  and  electromechanical 
equipment  that  reflected  these  environmental  factors.  Data  were  available  on  several 
operating  applications  for  these  equipments;  the  three  of  these  which  were  used  are 
described  below. 

3.2.2. 1  Portable  Ground  Environment 

The  generator  set  is  in  a  portable  condition,  not  rigidly  mounted  in  a  fixed  installation; 
it  can  be  moved  from  place  to  place  in  vehicles  traveling  ever  unimproved  roads  and  can  be 
loaded  and  unloaded  manually. 

3.2.2.2  Tracked- Vehicle  Environment 

The  generator  set  is  mounted  on  a  cracked  vehicle  capable  of  traveling  over  open  terrain. 
The  set  is  subject  to  severe  shock  and  vibration  in  transport.  The  sets  will  normally  be 
operated  while  the  vehicle  is  not  moving,  although  operation  is  not  restricted  to  times  when 
the  vehicle  is  stationary. 

3.2.2.3  Laboratory  Environment  (Hypothetical  System  With  Idealized  Characteristics) 

The  laboratory  environment  was  used  to  meet  the  contract  requirement  to  develop  a 
prediction  for  a  hypothetical  system  with  idealized  characteristics.  The  laboratory 
conditions  are  based  or.  the  assumption  that  the  sets  are  functioning  in  an  ideal  environment 
with  skilled  personnel  performing  the  operational  tests.  It  is  believed  that  the  data  produced 
under  these  conditions  show  the  best  achievable  reliability  for  the  prototype  models  and 
indicate  what  can  be  expected  from  production  units  in  the  field  that  are  superior  in  design 
and  reliability  to  the  prototype  generator  sets.  The  system  manufacturers  currently  believe 
that  the  best  method  to  achieve  higher  system  reliability  is  to  improve  the  design  rather  than 
incorporate  redundancy. 


3.3  FAILURE  DEFINITIONS 


The  loss  of  any  critical  component  that  prevents  the  generator  system  from  meeting 
100-percent  power-output  capability  results  in  system  failure.  A  critical  component  is  any 
item  or  part  whose  failure  would  preclude  successful  operation  of  the  system  or  create 
safety  hazards.  Included  in  this  category  are  the  components  required  for  starting  the 
system  since  without  starting  capability  power  output  cannot  be  achieved. 

Failure  of  any  safety-shutdown  circuit  is  a  system  failure.  These  circuits  are  fail-safe  — 
that  is,  the  loss  of  one  of  them  will  automatically  shut  down  the  system. 

3.4  ASSUMPTIONS 

After  the  system,  the  missions,  and  failure  were  defined,  the  following  major 
assumptions  were  made  to  establish  prediction-model  limitations; 

■  Once  the  system  has  exceeded  the  infant-mortality  period,  the  failure  rate  does  not 
change  during  the  life  of  the  system  (exponential  distribution). 

•  All  components  must  function  properly  at  the  prescribed  time  in  the  mission  for 
complete  system  success. 

•  System  safety-shutdown  circuits  are  not  fail-safe. 

•  Generator-set  maintenance  will  not  include  any  components  in  the  fluid  loop, 
because  the  loop  is  hermetically  sealed  by  the  manufacturer  or  depot. 

3.5  RELIABILITY  BLOCK  DIAGRAMS 

A  reliability  block  diagram  is  a  pictorial  chart  of  a  system  or  subsystem  that  depicts  the 
interactions  between  the  components  of  the  system  and  the  effects  of  a  component  failure 
on  the  system. 

Figure  5  if  the  reliability  block  diagram  for  an  organic  Rankine-cycle  engine  generator 
system  composed  of  four  functional  groups  or  subsystems; 

•  Fluid-Loop  Group  —  any  component  that  comes  into  direct  active  contact  with  the 
organic  fluid 

•  Power-Generation  Group  —  the  components  and  circuits  that  make  up  the 
power-generation,  -conditioning,  and  -rectifying  segment  of  the  generator  sets 
(excluding  the  alternator  in  the  STRATOS  system,  which  is  included  in  the  fluid-loop 
group  because  it  is  hermetically  sealed  in  the  loop) 

•  Electronic  Control  Circuits  Group  —  the  circuits  that  control,  regulate,  and  protect 
the  generator  set,  along  with  the  electronic  or  electrical  sensors  providing  the  proper 
input  signals 

•  Support-Components  Group  —  components  or  items  that  do  not  directly  fall  into 
the  other  three  groups  and  provide  a  supporting  service  to  the  end  mission  of  the 
generator  set 
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Figure  5  RELIABILITY  BLOCK  DIAGRAM,  ORGANIC  RANKINE- 
CYCLE  ENGINE  GENERATOR  SYSTEM 


Figures  6  and  7  are  the  functional-group  reliability  block  diagrams  for  the  STRATOS 
and  TECO  systems,  respectively.  A  five-digit  code  is  assigned  to  every  block  in  the  reliability 
diagrams  for  identification  in  the  computer  mathematical  model  when  failure  distributions 
are  being  inputted.  Whenever  a  change  is  made  in  the  diagram,  it  is  necessary  to  add  or 
subtract  a  code  depending  on  whether  a  component  is  added  or  removed. 

3.6  RELIABILITY-PREDICTION  EQUATION 

The  rehability-predictior  equation  expresses  the  mathematical  relationships  between 
the  system  components  in  the  reliability  block  diagram,  showing  how  they  are  related  to 
overall  system  reliability. 

The  Rankine-system  components  have  basically  a  direct  series  relationship.  The 
computer  model  calculates  the  reliabilities  of  all  the  components  individually.  The  failure 
distnbution  of  each  component  or  circuit,  the  amount  of  accrued  operating  time  on  the 
component,  and  whether  or  not  the  component  is  a  redundant  element  in  the  overail  model 
are  required  for  these  calculations.  These  data  are  inputted  into  the  model  with  the 
component’s  five-digit  identification  number  (see  Chapter  Six). 

The  series  model  for  either  generator  system  composed  of  n  elements  can  be  simply 
expressed  as 

Rs  =  II  Rj(t)  =  Rj  •  Rj  •  R3  Rn 

S“I 

The  equations  for  calculating  the  reliabilities  from  the  four  distributions  used  in  this  study 
for  anv  single  component  are  as  follows: 

Exponential 
Rj(t)  -  e"X'1 
Normal 


(t-  0 13 
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Figure  6  (continued) 
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Figure  7.  FUNCTIONAL-GROUP  RELIABILITY  BLOCK  DIAGRAMS 
FOR  TECO  SYSTEM 
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Figure  7  (continued) 
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It  was  necessary  to  use  exponential  data  for  the  predictions.  However,  during  prototype 
testing  and  development  testing,  with  the  proper  data-collection  techniques  and  sufficient 
test  time,  it  will  be  possible  to  develop  the  true  failure  distributions  for  each  component. 
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CHAPTER  FOUR 


DATA  COLLECTION 


4.1  DEVELOPMENT  OF  EQUIPMENT  FAILURE  RATES 

Since  operational  data  were  not  available  for  most  of  the  components  in  the  two 
systems,  it  was  necessary  to  research  a  number  of  failure-data  sources  to  obtain  data  on 
similar  components.  The  primary  sources  are  Government  and  contractor  data  banks,  which 
offer  failure  histories  for  a  variety  of  mechanical,  electrical,  and  electronic  components.  The 
sources  used  for  this  study  are  listed  in  Appendix  A. 

To  obtain  appropriate  component  failure  rates,  all  the  available  failure  rates  from  the 
data  sources  used  were  listed  and  then  screened  for  a  besbfit  average  failure  rate  in  a  known 
environmental  condition.  The  environmental  conditions  for  the  data  ranged  from  the 
laboratory  to  space  vehicles.  Tables  1  and  2  present  component  failure  rates  for  the  two 
Rankine-eycle  generator  systems.  It  is  emphasized  that  all  of  the  failure  rates  are 
exponentially  distributed.. 

It  was  assumed  that  a  portable  generator  set  would  not  be  subject  to  a  singie 
environment:  therefore,  three  K  factors  were  developed  from  the  data  sources.  The  fourth  K 
factor  is  not  environmentally  oriented  but  simply  \d’  asts  the  failure  rate  listed  in  the  table 
to  that  developed  bj  the  manufacture.  It  is  thus  possible  to  show'  the  manufacturers' 
estimated  reliability  m  comparison  with  the  three  environmental  categories  described  in 
Chapter  Three..  The  K  factors  are  as  follows: 

K,  —  Manufacturer  Adjusting  Factor 

K:  —  Portable-Ground-Environment  Factor 

K3  —  T rack -Vehicle-Mounted  Factor 

—  Laboratory  (Hypothetical  System)  Factor 

It  js  apparent  from  the  tables  that  there  are  numerous  adjusting  K  factors  for  each 
environmental  condition.  The  reason  for  this  is  that  different  data  sources  were  used  and 
there  is  no  universal  factor  for  all  equipments.  The  failure  rates  of  most  equipments  increase 
as  shock  and  vibration  increase;  thus  a  higher  multiplying  K  factor  is  required  for  the 
trrcked-vehicle  environment  to  increase  the  average  failure  rate. 

There  are  very  few  failure  data  on  mechanical  equipments  that  show  the  effects  of 
extreme  cold  or  heat  on  operating  life.  Temperature  effects  were  therefore  not  considered  m 
the  environmental  conditions. 

The  delivery  of  the  manufacturer’s  prototype  system  to  USAMERDC  for  operational 
testing  is  the  ideal  time  to  begin  a  data-colleetion  program.  There  is  very  bitie  operational 
information  on  organic  Rankine-cycle  systems;  to  perform  a  complete  evaluation  of  the 
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Table  /  COMPONENT  FAtLl'RE  DATA.  STRATOS  FA’GINK  GENERATOR  SET 
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Table  2  COMPONENT  FAILCRK  DATA.  TECO  ENGINE  GENERATOR  SET 


Component  Ni me 


K,  K2 
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Boiler 
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21040 

Throttle  Valve 
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generator  sets,  more  accurate  values  of  mean  time  between  failures  than  provided  in  this 
report  should  be  obtained.  It  will  be  necessary  to  develop  a  data-collection  and  feedback 
system  that  will  provide  the  proper  historical  information  for  improving  design,  lowering  the 
cost  of  equipment  repair,  and  reducing  equipment  downtime  due  to  frequent  failures. 

4.2  DEVELOPMENT  OF  EQUIPMENT  MAINTENANCE  DATA 

The  information  available  for  estimating  component  repair  times  is  inadequate.  Both 
manufacturers  are  planning  systems  with  hermetically  sealed  organic-fluid  loops;  this  will 
require  that  the  generator  set  be  transported  back  to  a  depot  maintenance  facility  or  the 
manufacturer  for  repair  of  any  component  that  involves  breaking  this  seal.  The  long-range 
development  plans  include  making  the  systems  repairable  at  the  field  maintenance  facilities 
by  providing  the  necessary  loop-purging  and  fluid-charging  equipment  at  that  level. 

The  only  equipments  intended  to  be  repairable  by  the  user  or  support-level  maintenance 
are  system-support  components  and  some  of  the  power-generator  components.  The  detailed 
design  information  concerning  these  areas  is  still  being  formulated  by  the  manufacturers  and 
is  not  yet  adequate  for  developing  realistic  mean-time-to-repair  (MTTR)  values.  However, 
STRATOS  furnished  a  list  of  estimated  repair  times  for  the  support  components.  The 
MTTR  for  organisational  maintenance  is  0.7  hour. 

A  detailed  examination  of  system  repairability  should  be  made  for  each  system, 
considering  the  present  repair-level  capabilities  of  both  the  prototyp  models  and 
anticipated  production  models.  Repair  times  can  be  obtained  at  the  same  time  prototype 
testing  is  being  performed,  and  recommended  design  improvements  can  be  reflected  in  those 
values. 

With  the  proper  data-collection  and  feedback  program,  the  best  reliability,  maintaina¬ 
bility,  and  availability  figures  can  be  obtained  for  the  prototype  designs  and  reasonably 
accurate  estimates  made  for  final  production  models. 
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CHAPTER  FIVE 


FAILURE  MODE  AND  EFFECT  ANALYSIS 


The  Failure  Mode  and  Effect  Analysis  (FMEA)  is  an  integral  part  of  the  reliability 
prediction.  It  is  a  systematic  examination  of  all  components  of  the  system  to  identify  their 
functions  and  bow  they  can  fail  and  to  determine  the  effects  of  each  component  failure  on 
the  overall  system  in  relation  to  mission  performance  and  personnel  safety. 

The  identification  of  problem  areas  can  lead  to  design  changes  that  improve  reliability 
end  maintainability  or  produce  savings  for  the  entire  program.  Based  on  FMEA  results 
program  management  can  adjust  the  test  and  evaluation  programs  to  provide  maximum 
assurance  that  the  probability  of  critical  failures  has  been  either  eliminated  or  reduced  to  a 
tolerable  level. 

In  an  FMEA,  mathematical  probabilities  of  occurrence  are  normally  assigned  to  the 
various  failure  modes.  For  this  report,  the  FMEA  «s  presented  primarily  to  permit  a  better 
understanding  of  the  Rankine-cycle  systems  and  the  interaction  of  the  components.  No 
attempt  is  made  to  assign  failure-mode  probabilities,  because  of  the  lack  of  historical  data 
on  equipment  of  this  type,  and  only  the  more  prominent  failure  modes  are  listed.  Since 
there  is  no  inherent  redundancy  in  the  system,  most  of  the  component  failures  have  the 
same  ultimate  effect  on  the  system  —  loss  of  power  output  Tables  3  and  4  are  the  FMEAs 
for  the  organic  Rankine-cycle  engine  generator  sets  of  Fairchild  Hiller  Stratos  Division  and 
Thermo  Electron  Corporation,  respectively. 

The  following  elements  comprise  the  FMEA  format  used: 

‘  Group  Code  Number  —  the  numbers  assigned  to  each  component  or  circuit  in  the 
reliability  block  diagrams  in  Section  3.3 

•  Description  of  Component/Assembly  —  the  nomenclature  of  the  components  or 
circuits  as  specified  by  each  manufacturer 

Function  —  the  general  description  of  each  FMEA  component’s  functioning  in  the 
system 

Failure  Mode  —  the  type  of  failure  judged  to  have  a  probability  of  occurring  during  a 
mission 

•  Failure  Cause  —  the  most  probable  causes  of  the  failure 

•  Failure  Effect  —  the  effect  of  the  failure  on  the  system  and  the  mission 

Criticality  —  the  severity  of  each  failure  mode  and  its  related  failure  effect  on  a 
discrete  phase  of  the  mission: 

••  Critical  (C)  —  a  failure  that  prevents  the  component  from  completing  a  discrete 
phase  of  the  mission  or  is  judged  hazardous  to  personnel 
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Major  (M)  —  a  failure  that  significantly  degrades  the  performance  of  the 
component  or  delays  its  function  such  that  it  may  not  complete  a  discrete  phase 
of  the  mission 

Minor  (m)  —  a  failure  that  does  not  have  a  significant  effect  on  the  ability  of  the 
component  to  complete  the  discrete  phase  of  the  mission,  but  should  be 
repaired  eventually 

Action  Taken/Avoidance  Technique  —  the  action  to  be  taken  by  the  user  to  return 
the  set  to  operational  condition;  or  the  technique  that  can  be  used  during 
manufacture  to  eliminate,  or  minimize  the  effect  of,  the  failure  mode  or  to  make  the 
set  easier  to  repair  in  the  field 
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Table  3.  FAILURE  MODE  AND  EFFECT  ANALYSIS  FOR  8TRATOS  ENGINE  GENERATOR  SET 


FLUID  LOOM  1ft 


Action  Takm/ 
Atuidaitce  Technique 


0  I  MirtiB*  Fluid 
I ,  farnp 


Working  fluid  deterioration 
from  overheating.  causing  cor¬ 
rosion  in  system  component* 

M/C 

Lorn  of  work  inf  fluid,  causing 
system  shutdown 

C 

System  shutdown,  cxenahe 
noise 

C 

<1)  Failure  to  rfme;  system 

m  M 

start-tip  w*M  be  drU>cd. 
posable  damage  to  terbo- 

altenutor  pump 
(2i  Failure  to  open;  system 

'C 

shut  down  by  safety  oi«< 
temperature  sensors 

(3)  Failure  to  open  tW  com¬ 

mC 

plete!)  :  system  output  re¬ 
duced  by  flow  restriction 

Inability  to  regulate  RPM  and 
loss  of  output  rrfuUUm 

V,C 

tMeriorataon  of  output  until 
i)tirm  shuts  down 

MC 

Primacy;  reduction  or  loss  of 
output  power.—  svstem  con¬ 
tinues  to  operate 

C 

Aerator) :  Unt  of  system 
ft  eduction  in  pumping  capa- 
bdtly.  rawsmg  reduced  syv 
tern  output  to  system  shut¬ 
down 

C 

Low  of  working  fluid,  causing 
deterioration  of  output  to  sys¬ 
tem  tow-peewure  shutdown 

Deterioration  unlit  system 

shuts  down 

ftedurrd  effirwnry 

M 

Lena  ot  rocking  fluid,  causing 
system  rautdewr; 

C 

improper  mixing  or  buildup  of 
hack  pressure  on  bearing  lube 
imei,  causing  overheating  of 
hearings 

MC 

**x-stem  at  down 

0 

(/*»  of  output 

mil 

t-o**  of  output 

in 

Open:  system  will  shut  down 
from  mefpf*-4MJri/*t»»n 

1: 

Close:  sytletn  wdt  hot  start  — 

/; 

posable  damage  (0  bmL*  or 
drtrftoraticft  of  working  ftuut 

from  nnkridig 

Open;  system  ranool  be 
started 

C 

Hose:  fnrrv  fl.rw  trough  j 

start  pump  into  roodemet 
will  rnb-rw  output  and  pos¬ 
sibly  rarr  system  sfcutd*»wn 

1  MC 

i/ow  pesirr;  born  out  T-A  P 
brartnjs  —  system  shutdown 

MC 

:  High  pneuir:  cwerfcibriratKvn 
of  hearmgsw  causing  fViid  flow 

MC 

mt«  artemator.  posable 

uww«  drag 

Possible  mabifity  In  start 

m.M 

fit  hi  re  to  siaft 

C 

ialarr  lo  start 

*  c 

Safetyderkes  will  present  ty  stem 
damage  t tom  (.ttfhrtilut  b>  shutting 
system  dawn. 


l/uirfitv  euntnd  and  testing  i« 
assure  inlitnl)  of  fdmirf 
tubmg,  bai«inc.  an d  bra/ing- 
PM  Inh  of  working  fluid  \bnuM 
lirtfrt  ron4wmlinn  brfw 
rntiral  buildup  on  tale  place. 
PM  mriudet  prrwrfir  f  lear-r*g  of 
iwidnwfwflr  fin  area. 


hiwjft  (j(r  bdairn  ntMlMic 
and  brattnrs  nil  g nr  ihetk 


Motor  should  hr  u<rr  rrpaoahh-. 


-  fntiril.  M  *■  m  *  \lriM, 


*11030  and  11090  are  combined  with  1 1 1*0 


(mnlmqrd) 


Table  3.  (continued) 


Group 
Co*  No. 

1 

Dearription 
of  Component/ 
Amrmhly 

— 

Function 

FsOw* 

Mode 

Fadure 

Cause 

Failure 

Effect 

Criti¬ 

cality* 

Action  Taken/ 

Avoidance  Technique 

11150 

Drains.  TAP 

Drain  fluid  that  leaks 
into  the  aJtetaaioe 
bock  Into  the  fluid 
loop 

Drain*  dogged 

Contaminated  working  fluid 

Alternator  fills  with  fluid. 
Viscous  drag  t*u*m  lost  of 
output  until  system  shuts 
down 

1 

11160 

Cooling 

Cod.  Altn- 

nuof 

Transfer  excess  beat 
from  Uie  alternator 
to  the  working  fluid 

Ruptured  or  dogged 
working-fluid  tube 

Fatigue,  thermal  stress,  shock, 
vibration,  or  contaminated 
working  fluid 

Gradual  lorn  of  working  fluid, 
caudng  eventual  system  shut¬ 
down 

I 

11170 

Coolly 

Coil,  Power 
Conditioner 

Transfer  exons  heat 
from  the  power  con¬ 
ditioner  to  the  wort¬ 
hy  fluid 

Ruptured  or  dogged 
working  fluid  tube 

Fatigue,  thermal  strew,  dioek, 
vibration,  or  contaminated 
working  fluid 

Gradual  tom  of  working  fluid, 
causing  eventual  system  diut- 
down 

C 

11020. 

11090. 

11180 

ThrmiNtor 
Connections, 
Piping  and 

Joint*.  and 
Bellows  Tube 

Connect  the  ecmpo- 
cenu  in  the  fluid 
and  allow  for  thermal 
expansion  of  the 

P*P*H 

Leah,  niniurr 

Fatigue  due  to  temperature, 
shock,  vibration 

Lorn  of  working  fluid,  causing 
reduced  output  to  system  duit- 
down 

m/C 

Before  the  fluid  loop  s  filled 
and  sealed,  a  betom  Irak 
test  should  be  performed  to 
insuie  loop  integrity. 

11190 

fiewur*^ 

Burs;  Disk 

Safety  device  in  fluid 
loop  that  niptu»-i  *o 
perrent  r\<  adve  ay*- 
tem  over  permute  if 
shutdown  circuit 

fails 

FattsbHow  rated  pres- 
wtr 

Faih  at  rated  pressure 

Faib  above  rated  peea- 
■Jie 

Manufacturing  defect 

System  ompmaure-shuldown 
circuit  (elk.  disk  works  as  de- 
signed 

Manufacturing  defect 

Premature  Ion  of  system 

Loss  of  system  with  no  dam¬ 
age  to  components  in  fluid 
loop 

Leas  of  system  with  possible 
serious  component  damage 

■ 

Pressure-burst  disks  represent 
final  safe  system  shutdown  be¬ 
fore  some  fluid-loop  compo¬ 
nent  is  damaged. 

System  safety  pcesnue  shut¬ 
down  must  be  calibrated  with 
great  rare 

11210 

Frrwire- 
Relief  Vahe 

FuikIkmu  in  con 
junction  with  the 
start-up  vahe  (110301 
to  allow  fluid  to  act 
on  the  beOows  at  the 
pre*rt  pcruxirr 

Valve  faib  to  ctase 

Vaive  frits  to  open 

Broken  spring,  ball  jammed 
in  orifice,  opening  dogged; 
ut  seat  eroded,  preventing 
ball  fmwi  sratirg 

Close*  system  start-up  may¬ 
be  retarded,  with  pomade 
damage  to  T-A-P 

Open,  system  shutdown  by 
urHy  cvertemprratufr  sen¬ 
sor 

FOWER  GENERATION' KflM 


140  HI 

Voltage 
Regulator  VR1 

Recedes  power  from 

PS2  and  provides 
field -cod  excitation 
f«*  primary  power 
circuits 

Fads  to  regulate 

Out  of  adjustment,  regulator 
fadure  from  thermal  stress. 
Aock,  vibration 

Output  voltage  out  of  speev- 
Citation  to  total  low  of  out 
put 

MC 

Modular  replacement  concept 
few  Hectrical  ebwtrooic  rmv*s 
will  mmimtw  downtime  and 
make  urut  um-rrpawaMe. 

14020 

Voltage 

Regulator  VR2 

Recenes  power  from 

PS2  and  provides 
fleW-cod  excitation 
for  arcemorw*  alter 
rut  or 

Fad*  to  regulate 

Out  of  adjustment,  regulator 
fadure  from  thermal  sties*, 
shock.  vibratKM' 

Accemonr*  output  voltage 
out  specification  to  total 
le*  of  accessories  power 

Mr 

See  14010 

54030 

Voltage 

Rrgulatos  VR3 

Recent-*  power  from 

PS2  and  provides  regu¬ 
lation  of  l&W  output 
for  Datlerv  charging 

Faili  ro  regulate 

Owl  of  ad^iumem.  regulator 
fadure  from  thermal  stress, 
shock,  vibration 

Improper  charging  of  bat¬ 
tery;  eventual  fom  of  bat¬ 
tery  power  and  eapabdKy 
to  start  system 

MV 

See  14010 

•mo 

Power 

C^tndilioning 
Cifruil  PM 

Thn-t- phase,  fuB-weve- 
reetifler  bridge  eircuit 
converting  primary 
ac  to  primary  dr 
power  >.tpul 

Keetifler  faib 

Normal  component  (adore 
-  shock  Hbntioo,  thermal 
sires* 

Reduction  in.  to  low  of, 
primary  power 

MC 

See  14010. 

14050 

Power 

(VinditKMimg 
dim*  PS2 

C  i^nrrrU  mtwn 
power  output  from 
ac  to  4r  for  arrev 
wniv  ue  and  for 
voltage  regulators 

VR1.  VR2.  and 

VR1 

Rectifne  fads 

Normal  component  fadure 
-  shock,  vihmion.  thermal 
strew 

Lorn  of  ad  power,  sydem 
shutdown 

c 

See  14010 

110G0 

Power 

(Condition  tag 
Orruit  PS3 

Converts  mt  atev 

KOrv  power  to  de 
for  cperslmo  of 
condenser  fan 
motor 

kertlfirf  fads 

Normal  component  fadoie 
—  short,  vibrato*,  thermal 
dre* 

Condemn  (an  motor  doav 
or  stop*  nronmg:  di pending 
on  ambient  temperature  and 
load  system,  could  smun 
operation  to  total  dwtdown 

mC 

See  14010. 

14070 

t’-onnevtor 

2  pm 

Coo  wet  l-oad  to 
Generator  Set 

Connector  pm 
bosks 

Drtenoration  from  environ- 

L““ 

Inabditv  to  connect  load  to 
set 

m  M 

1 

In  rcwpsn  rewwMt  can 
be  jumprmt  Repairable  nv 

IM? 

ELECTRONIC  CONTROL  CIRCUITS- 1  MM 

16010 

Overvoltage 

Crowbar 

Circuit 

Protect  control  s* 
rurts  from  uvtr- 
volUge  rondKjon 

Partem  of  fwrurt. 

open 

Fadure  of  circuit  component 
frto  shock,  vibration,  ther 
mat  styes*  or  random  com¬ 
ponent  fadure 

Open  no  effect  rmles*  nr 
«ll  n  needed,  at  which  time 
controLcWvuK  damage  could 
result  from  windup 

iuC 

Frem  to  test  loop  may  be 
method  of  determimtg  if 
circuit  H  ttadaNe. 

fadure  »*f  circuit, 
droned 

Same  a*  above 

Shorted  r*  trip  out  rkrruit 
brasher,  shutting  system 

down 

C 

See  14010 

16C20 

_ 

30  Second 

Tuner  tifcsit 

Begin  openring  the 
sun  pump  and 
bodrf  Monet  fan  dur¬ 
ing  cyitrwi  dart  up  in 
order  to  prime  the 
bndrv  with  fluid  and 
purge  it  of  fuH  vapor 
poor  to  ignKnri 

Fadure  of  circuit 

Same  a*  ahene 

System  wvtl  not  start 

C 

See  14010 

(ctmtmwedi 


Table  3  (rontwued) 


(iruwc 
Code  No. 


lbom 

and 

16140 


16010 


16050 

and 

16160 


16360 

and 

16150 


16070 


1 60  SO 


16IW 


l»*1  in 


1*120 


!<»»■» 


Ikesropticfi 

Function 

lukn 

Fadure 

Failure 

Cote 

Action  Taken/ 

Awr.abiy 

Mode 

Came 

Effect 

cahty* 

Aiosdawce  Technique 

(h«tempfr» 

Shut  down  system 

Fat*  signal 

Same  as  abo*e 

System  will  shut  down 

C 

See  J4010 

turf  C otuIi 

If  working-fluid  temper 
aturr  exceeds  ?00’K  by 

Faduir  to  trmr  over- 

If  safe  shutdown  i  required 

■Ault m*  off  fuel  wppty 

temperature  condition 

and  does  not  oceu ,  system 
ran  be  smou><>  di  waged 
from  rnrrbe  .ring*  Jser 
speed  omirt  >  6f  *)>  should 
funrtlor.  Tint 

*1- Minute 

ftrk  up  the  dart  sc- 

Failure  u>  control  start- 

clectricai -component  (all- 

Failure  to  start  »\Mcm 

C 

Module  repiaceioent  of  rtfrud  would 

Timer  Cmvll 

quenre  from  the  30- 

up  wquenrr 

are  due  to  temperature. 

riwnmaie  down  time  and  make  system 

***rond  timer  omiK 

vibration,  shock,  or  random 

wsrr-reparable 

and  f  rokldr  the  rap* 

circuit  faituie 

Failure  to  sequester  startup 

m  V 

Safety  devices  should  be  located  to 

bdrty  to  start  the  $>  s- 

mode  proprrfy  -  no  prob- 

prevent  ignition  when  large  amounts 

letr*.  coordinate  ail  the 

irm.  to  no  system  start,  or 

■A  unbumed  fuei  have  been  injected 

machinery  required 

danger  to  personnel  from 

into  boiler 

fur  startup.  remove 
machinery  from  loop 

boSrt  explosion 

on  proper  trqucoc*- 
of  starting,  and  shut 
down  on  false  Mart 

A  if  and 

Setur  workinj!  fk*id 

Low  of  ^*xal 

Open  control  ctrrutl 

System  shutdown  or  failure 

C 

1 4010 

M  rale 

temperature  and  de- 

to  start 

Control 

Omul 

term  me  the  mwuit 
of  air  and  fur!  re¬ 
quired  to  rtWiaUin 

Lom  of  contnjf  fuB 
open 

Fetarr  of  one  or  mote 
circuit  component! 

FuM  open  hi«h  hodrr  temper 
at  err;  syitero  mtiwn  to 

aV 

the  generator  load 

ovctpmwute  wiB  cause  safetv 

and  operate  (be  rom- 

bustioc  air  (an  and 
fuel  pump  to  pnnide 

to»  of  control.  full 

Full  closed  \rtrm  shutdown 

that  amount 

dewed 

or  fjdure  to  start 

Spreo-t  ontrol 

Sense  working  fluid 

Failure  of  rontml 

Con  lamina!  km  and  wear 

Iftxtahdity  -  Iom  of  output 

» 

Sn>  UOIO 

<Tmm. 

temperature  at  the 

nmnt 

of  the  lemprratore  sen- 

regulation 

Condenser 

rondena-r  lliOflOj 

son  open,  short,  grounded 

M 

Fan 

exhaust  port,  turn 

Mi;  on  the  fan 
mol  or  or  Ifirnminf 

control  nrruK 

tows  to  operate;  system 
runs  at  rewuerd  efficiency 

decfr*sin(  fan  unvd 

Failure  dosed  -  lom  of  fan 

conlmg.  temperature  pnwwjie 

state  flow 

me  causes  safety  shutdown  of 
ssstem 

Speed  Control 

Sense  the  speed  of 

Fathne  of 

Open,  shorted.  (rounded 

Lom  of  output  regulation 

Mir 

See  140)0 

iVruit 

the  alternator  and 

rontml  circuit 

.-smit t  due  .o  fadare  of 

TurtMnr 

send  a  «nai  in  the 

one  or  more  rtmiti  r»-ov- 

linear  proportional 
Milmod.  which 
mines  the  rmdule 
thm  valve  to  main¬ 
tain  constant  RfM 

ponenu 

(hrrsptd 

Shut  svxtem  down 

Failure  of 

Same  as  above- 

If  overvpred  i«sdiU««  otrwv 

Circuit  rharartemtx  mas 

I’m  int. 

In  culling  off  fuH 

control  circuit 

and  the  cwrttrt  does  no*  faw- 

make  tt  advantageous  to  inceepumie 

|  Turtstfw- 

M>ppl\  Should  tUf 

to  sense  mrf 

tion.  the  svOetn  runs  until 

the  ^eed  control  rmvil  with  Iho 

bine  menpred 

speed 

nvcrtttnpmtirte  shutdown 

nmtd  to  improve  svslem  iriubutU 

| 

i 

occurs  or  feedpump  muta¬ 
tion  occurs,  out  pet  voltage 
wdl  he  u 'sc. m* nd table 

c 

See  JfOlO 

t  (imiiut 

Inlnnniuti  the 

Failure  of 

Circuit  open,  -hort-d. 

No  uastedwte  effect.  t»»  ssstem 

mV 

See  14010. 

!  fonnerting 

control  orruits 

control  circuit 

grou.ided  from  thermal 

shutdnw>  nr  mabdits  to 

;  C»m;ii 

forming  an  ml*t 

sires*,  vibration,  shark  or 

start 

i 

actin*  network  to 
start,  run  pfmrr*. 
and  shutdown  the 

f  w  rator  et 

nonncl  J»fr  wvwmut 

.  1  Itnwww 

<‘.*n»eft  death 

1  tv s  of  signal  <ul[»l 

Omit  component  fadure 

Fuel  not  atomi/rd  into  hosier. 

r 

s.-  iioia 

t  ttoni/ff 

stale  dc  into  a 

from  thermal  sires*,  sihra- 

causing  safetv  hazard  and 

*  iflator 

puluat  cTTmK 

tarn,  shock  nr  normal  life 

tem  shutdown 

l  »r»ui? 

for  the  atofpi/er 

wesrout 

; 

efwi 

improper  signal  out 

fartenoration  of  ctrcuH 

Improper  burning  of  fur*  t% 

Ml* 

pul 

component 

hosier,  determratum  t«»  Vw. 
of  rombwdirtft  and  ssstem 

!  ffWWW 

Provide  the  signal 

Ignition  lw 

Opm  control  cirrutt 

System  shutdown  «r  fariviro 

f‘ 

See  1401O 

1  Off  Mil 
i 

an <J  evrrmt  to  the 
ifmtor 

to  start 

i  New! 

Rices. e  'he  sipisi 

Failure  of  snirarad 

Open.  dHatcd.  grounded 

Inahifitv  to  control 

r 

!  Illlrrt 

from  the  pmJ 

-fid 

tufbme  * prod 

j 

1  vontmi  ihnui 
!  t  160701  and  tranv 
late  that  min  a 
fcwa*  inotaw  to 
move  modulation 

|  vaitdUOIOi 

'*16!  SO  p  nxnbiwii  «i<h  lfiVJO  16150  t*  rtMiKit!  with  |W*(>  1616*1  n  16J50 
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tirocip 
t«dr  Wo 

IWnpiK* 

«f  t  oarponmt  f 
Auwwsbty 

Fmcum 

Fadure 

Mode 

j  1 

Failure 

Effect 

Olti- 

eKy* 

Acium  Take*/ 

Arc  i  dan  re  Tecbnigue 

FLUID  LOOf.ZIMt 

JIlHO 

IknleT  (  cifl. 

tWrrt  Ihc  unrktwg 

Rupture  in  working-fluid 

{ Kerb  mating.  fatifur.  thermal 

Working  fluid  drtrnontrd 

HiC 

Safety  drvKm  will  prevent 

•U*  ki-t  and 

fluid  <(T34)  (rum  a 

lube 

rtfuuui 

b>  iMKMf  with  buffer  fluid. 

sy  stem  ih  page  due  to  over 

4  asm* 

■•quid  to  a  upot.  srpa 

causing  grsduat  reduction  m 

premurtzaikm  by  shutting 

rate  the  working  fluid 

output 

system  down 

Rupture  tn  buffer  flutd 

Osithratmg.  fatigue,  thermal 

Working  ftu^  hot  spoU  due 

u  c 

the  burner  flunr 

tlrbr 

etpamioe 

to  lam  of  buffer  Outd.  auung 
gridur*  reduction  »  out  pet 

System  shutdown  resulting 
faun  buffer  fluid's  rx trago (th¬ 
ing  flame 

c 

Ruptured  boiler  rasing 

Hut  «tar1.  C*t<ur.  thermal 
rtpmnw 

S>atem  shutdown 

c 

:ioui 

V|ural<* 

-Vpmlr  Mm  niomr 

Cultrrti*  srtlTtl  riufH 

Ibtwut  buildup  on  utm  frum 

Reduced  efficiency 

M 

\v*-mbts 
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CHAPTER  SIX 
COMPUTER  PROGRAM 


The  computer  program  was  developed  on  a  time-sharing  system  with  basic  FORTRAN 
used  as  the  language.  This  made  the  program  suitable  for  use  on  USAMERDC’s  COMSHARF, 
time-sharing  system  with  their  preferred  XTRAN  language. 

The  program,  described  and  illustrated  in  Appendix  B,  is  designed  to  assess  the 
reliability  of  a  simple  series  system.  It  can  assess  individual  component  redundancy  when 
the  appropriate  inputs  are  provided  for  the  redundant  elements.  Four  reliability  or  failure 
distributions  can  be  manipulated  in  the  program:  the  exponential,  normal,  lognormal,  and 
probability  distributions.  It  is  not  necessary  for  all  components  to  have  the  same 
distribution,  but  one  component  cannot  have  two  failure  distributions  at  one  time.  The  four 
individual  K  factors  can  be  applied  to  the  single  component  failure  rate  to  account  for 
different  system  environments. 

Appendix  B  also  presents  detailed  instructions  for  exercising  the  program  on  a 
time-sharing  computer  terminal. 
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CHAPTER  SEVEN 


RELIABILITY  AND  AVAILABILITY  PREDICTIONS 


7.1  RELIABILITY  PREDICTIONS 

Reliability-prediction  models  were  developed  to  represent  the  organic  Rankir.e-cycle 
engine  generator  sets  of  Fairchild  Hiller/Stiatos  Division  and  Thermo  Electron  Corporation. 
From  these  models,  a  computer  program  was  derived;  it  yielded  quantitative  reliability 
predictions  for  the  two  systems. 

Table  5  shows  the  specific  results  of  the  computer  program  for  the  two  manufacturers’ 
generator  sets,  operating  for  the  two  specified  missions  in  the  three  environments. 


Table  5.  RANKINE-SYSTEM  PREDICTED  RELIABILITY 

K 

Mission  2 

Mission  2 

Factor 

STRATOS 

TECO 

STRATOS 

TECO 

Manufacturer 

0.9882 

0.9941 

0.9516 

0.9757 

Portable 

0.9703 

0.9766 

0.8819 

0.9061 

Track  Vehicle 

0.8752 

0.8990 

0.5736 

0.6415 

Laboratory 

0.9950 

0.9948 

0.9794 

0.9787 

It  can  be  seen  that  the  more  severe  the  environment,  the  lower  the  probability  that  the 
generator  set  will  achieve  the  stated  mission.  The  manufacturers’  estimates  for  their  own 
system  reliability  are  also  included  for  comparison  purposes.  An  examination  of  their  data 
and  the  final  results  indicates  that  they  assumed  a  fixed  ground  installation  rather  than  one 
m  which  the  Rankine  system  would  be  portable.; 

There  is  little  significant  difference  in  the  system  predated  reliabilities  for  either 
manufacturer  for  any  given  environment  and  mission.  Operational  analysis  and  accumulated 
failure  data  may  yield  different  empirical  results. 
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7.2  AVAILABILITY  PREDICTION 


The  goal  is  to  achieve  a  system  inherent  availability  of  98  percent  for  each  of  the 
Rankine-cycle  generator  sets.  Inherent  availability  is  based  on  active  operating  and  repair 
time  and  is  the  probability  that  the  system  will  operate  satisfactorily  when  called  upon. 

Mathematically,  it  can  be  defined  as 


_ MTBF 

A'  ~  MTBF  +  MTTR 


where 


A;  =  Inherent  availability 

MTBF  =  Mean  time  between  failures  (hours) 

MTTR  =  Mean  time  to  repair  (hours) 

Since  a  large  portion  of  the  organic  Rankine-cycle  generator  set  will  not  be  repairable  at  the 
organizational  level  of  maintenance,  the  estimate  of  the  steady-state  inherent  availability  is 
calculated  as  follows: 


MTBF  (repairable  components) 

A<t)  =  1  — -  X  Rj_  (nonrepayable  components) 

MTBF  +  MTTR  (repairable  components) 

Table  6  shows  the  results  of  the  availability  predictions  for  the  portable  ground 
environment  (K; )  for  the  24  hour  mission  only..  The  maintainability  information  needed  to 
derive  the  inherent  availability  was  not  available  at  the  time  this  report  was  prepared,  except 
for  the  STRATOS  MTTR  estimate  of  0.7  hour;  the  maximum  specified  downtime  of  three 
hours  was  therefore  used  to  compare  the  impact  of  repair  on  both  systems’  availability. 


Table  6.  ESTIMATED  STEADY-STATE 
INHERENT  AVAILABILITY 

MTTR 

Source 

. 

STRATOS 

TECO 

r 

MTTR 

(Hours) 

A(t) 

MTTR 

(Hours) 

A(t) 

Manufacturer 

0.9171 

— 

— 

Contract 

Goal 

3.0 

0.9709 

3.0 

0.9783 

Because  of  the  large  number  of  nonrepairabie  components  and  the  high  MTBF  for  the 
repairable  components,  the  availability  prediction  diff>  rs  only  slightly  from  the  reliability 
prediction. 


CHAFTER  EIGHT 
FLUIDIC-CONTROL  APPLICATION 


In  the  present  concept  the  organic  Rankine-cycle  engine  generator  sets  will  be 
controlled  with  electronic  circuits.  Since  electronic  circuits  can  fail  catastrophically,  another 
method  of  system  control  is  being  investigated  —  the  use  of  fluidic  components  that  are 
powered  by  the  organic  fluid’s  vapor  pressure.  Tl.i  investigation  to  date  has  considered  only 
the  electronic  circuits  proposed  by  the  two  manufacturers. 

The  critical  question  is  whether  fluidic  circuits  can  completely  take  the  place  of 
electronic  circuits  in  the  generator  set  It  is  possible,  but  it  is  also  believed  that  complete 
fluidic  control  is  not  practical.  Fluidic  circuits  cannot  compete  with  electronics  in  response 
time.  Electronic  responses  are  in  microseconds  and  fluidics  in  milliseconds.  Fluidic  circuits 
are  also  usually  larger  than  their  electronic  counterparts. 

Yet  fluidics  has  some  advantages  over  electronics  in  tha,  the  controls  can  be 
hermetically  sealed  in  the  fluid  loop.  Contamination  would  be  minimized,  and  there  would 
be  no  dust  or  atmospheric  corrosion  to  affect  relay  contacts,  open  leads,  or  solder  joints. 
There  are  few  moving  parts  in  a  fluidic  circuit,  as  there  are  in  electronic  relays  or  stepping 
switches.  Vibration  is  not  a  problem  since  the  fluidic  circuits  are  stacked  and  then 
fusion-bonded,  forming  an  extremely  rugged  device. 

In  the  organic  Rankine-cycle  generator  sets,  the  best  areas  for  the  fluidic  circuits  are 
those  in  which  pressure,  temperature,  or  speed  is  being  sensed  and  being  converted  to 
motion  to  regulate  flow.  The  circuits  in  the  system  that  detect  fluid  pressure  and  convert  it 
to  an  output  signal  to  control  the  condenser-motor,  fuel-pump,  and  blower-motor  speeds  are 
best  left  as  electronic  circuits.  These  are  electrical-signal  input  and  output  circuits;  present 
fluidic  circuits  are  not  as  compact,  and  their  response  time  is  slower. 

The  reliability  of  fluidic  circuits  is  still  in  the  very  early  prediction  stage.  Very  little 
operational  information  has  been  accumulated  on  the  circuits  because  of  their  still-limited 
use.  It  is  known  that  leaks  and  contamination,  are  the  most  prevalent  failure  modes,  and  it  is 
believed  that  fusion-bonding  the  fluidic  circuit  and  hermetically  sealing  the  unit  ini  >  the 
Rankme  fluid  loop  would  virtually  eliminate  these  failure  modes. 

With  the  organic  Rankine-cycle  generator  sets  in  the  development  stage,  it  may  be 
premature  to  consider  fluidic  circuits.  Each  engine  manufacturer  is  stiii  making  design 
changes,  fiuid-loop  conditions  are  being  revised,  and  the  exact  method  of  system  control  is 
still  unknown  in  some  instances.  The  design  and  fabrication  of  a  fluidic  circuit  in  itself  is  a 
complex  effort  because  of  the  many  unknowns  and  the  lack  of  off-the-shelf  standaidized 
components 
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.  Jht  f!aflblli,ty  of  flui<?ic  circuits  should  definitely  be  investigated  and  tentative  designs 
established  for  the  use  of  fluidic  controls  on  the  generator  sets.  The  actual  incorporation  of 
partial  fluidic  controls  should  take  place  only  when  the  organic  Rankine-eycle  generator  sets 
function  properly  and  demonstrate  their  practicality  for  use  as  field  mobile  power  sources. 
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CHAPTER  NINE 


CONCLUSIONS  AND  RECOMMENDATIONS 


The  primary  objective  of  this  program  was  to  provide  USAMERDC  with  a  quantitative 
appraisal  of  the  predicted  reliability  of  two  organic  Rankine-cycle  engine  generator  systems. 
The  tasks  performed  to  meet  this  objective  led  to  the  following  conclusions: 

•  The  two  manufacturers  are  constructing  generator  sets  under  different  power 
requirements.  Care  should  be  exercised  in  making  comparisons.  The  predictive  results 
show  little  significant  difference  between  the  reliabilities  of  STRATOS's  or  TECO’s 
Rankine  systems. 

•  The  electronic  control  circuits  had  extremely  high  failure  rates  and  contributed 
heavily  to  system  unreliability.  TECO  is  still  designing  its  control  circuits;  therefore, 
the  STRATOS  failure  rates  were  used  for  the  yet  undesigned  circuits.  In  this  way,  the 
impact  is  the  same  on  both  manufacturers.  When  TECO  completes  its  design,  the 
TECO  model  can  be  modified. 

•  The  failure  rates  used  in  this  project  are  estimates  based  on  historical  data  from 
similar  equipment.  Until  firm  system  failure  data  are  developed,  the  results  should 
not  be  considered  empirical. 

•  The  hermetically  sealed  fluid  loops  cause  the  major  portion  of  the  generator  sets  to 
be  nonfield-repairable.  This  contributes  heavily  to  system  unavailability. 

ARINC  Research  Corporation  recommends  the  following  courses  of  action  based  on  the 
results  of  the  analysis: 

•  Implement  a  data-collection  and  feedback  procedure  for  MERDC  and  the  manufac¬ 
turer’s  testing  program  of  the  organic  Rankine-cycle  engine  generator  set. 

•  Perform  a  detailed  design  analysis  of  the  Rankine  systems  to  determine  ihs  best  areas 
for  design  improvement,  redundancy  of  components,  and  repairability  to  improve 
reliability,  maintainability,  and  availability. 

•  Begin  developing  a  life-cycle  cost  program  to  evaluate  the  proposed  designs  for 
portable  field  generator  sets  against  those  now  in  use.  The  evaluations  should 
consider  as  a  minimum  initial  production  and  procurement  costs,  operational  costs, 
and  the  effects  of  repairability,  logistics,  reliability,  and  maintainability. 

•  Make  a  critical  evaluation  of  fluidic  circuits  versus  modular-replacjment  electronic 
circuits  for  the  Rankine  generator  sets.  The  present  estimates  of  control-circuit 
reliability  may  make  fluidic  circuits  a  wise  choice. 
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APPENDIX  A 


SOURCES  OF  FAILURE-RATE  DATA 


APOLLO  Reliability  Prediction,  Estimation,  and  Evaluation  Guidelines,  National 
Aeronautics  and  Space  Administration,  December  1963. 

RADC-TR-114,  Volumes  1,  II,  and  III,  Data  Collection  for  Nonelectronic  Reliability 
Handbook,  Rome  Air  Development  Center,  Air  Force  Systems  Command,  Griffiss  Air  Force 
Base,  New  York,  June  1968. 

Failure  Information  Notebook,  Special  Technical  Report  No.  32,  ARINC  Research 
Corporation,  December  31,  1965. 

Mechanical  Design  and  System  Handbook,  Harold  A.  Rothbart,  McGraw-Hill  Book 
Company,  New  York.  1964. 

MIL-HDBK-217A,  Reliability  Stress  and  Failure  Rate  Data  for  Electronic  Equipment , 
Department  of  Defense,  1  December  1965. 

Army,  Navy,  Air  Force  and  NASA  FARADA  Failure  Rate  Data  Program,  Volumes  1,  2, 
3,  and  4,  Naval  Fleet  Missile  Systems  Analysis  and  Evaluations  Group,  Corona,  California. 
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APPENDIX  B 


COMPUTER  PROGRAM  FLOW  CHART  AND  INSTRUCTIONS  FOR  USE 


FLOW  CHART 

The  flow  chart  for  the  computer  program  is  presented  in  Figure  B— 1.: 

INSTRUCTIONS  FOR  USE  ON  TIME  SHARING  COMPUTER  TERMINAL 

The  steps  described  herein  must  be  strictly  adhered  to  for  the  program  to  function 
properly. 

When  a  link  with  the  time-sharing  system  is  established,  the  first  symbol  seen  after 
“RUN”  is  typed  is  an  equa!(=)  sign.  After  the  equal  sign,  type  the  number  of  components 
(N)  in  the  system  and  the  number  of  cycles  of  operation  (M)  (ten  maximum).  Each  of  these 
variables  is  allocated  two  places,  and  the  date  must  be  right-justified. 

A  second  equal  sign  will  then  appear,  and  the  M  sets  of  times  of  operation  must  be 
typed.  Each  set  consists  of  two  times,  a  startup  time  and  a  run  time,  in  units  of  hours.  Each 
time  is  allocated  five  places;  it  must  be  typed  with  a  decimal  place  and  in  such  a  way  that 
none  of  the  five-digit  fields  overlap. 

The  third  and  last  equal  sign  will  appear,  and  the  K -factor  codes  (1  to  4)  must  then  be 
punched  for  the  M  cycles  of  operation.  These  factors  are  used  to  adjust  the  failure  rate  and 
mean  values.  There  must  be  K  factors  for  both  startup  and  run;  each  K  factor  is  punched  in 
an  12  format  This  ends  the  data  entry  at  the  keyboard  at  the  time  of  execution. 

The  failure  rates,  means,  accrued  operating  time,  and  K  factors  are  stored  as  file  and 
called  “XRDATA”  for  Fairchild/Stratos  and  “YRDATA”  for  Thermo  Electron.  Before 
running  the  program  (XMODEL),  it  is  necessary  to  type  the  following  line  if  the  data  file  for 
Fairchild/Stratos  is  to  be  used:  90  READ  (“XRDATA”,  4)  (ISP(I,  1),  ISP(I,  2)  IDST(I), 
( VAR(I,  J),  J  =  1,  7),  I  =  1,  N), 

The  term  XRDATA  must  be  changed  to  YRDATA  if  the  Thermo  Electron  data  file  is 
used. 

When  the  data  are  prepunched,  the  following  format  is  used,  where  one  line  represents 
one  component: 

•  Columns  1—5  contain  a  line  number  code.  This  is  not  used  by  the  model  program  but 
is  used  to  edit  and  update  data  entries. 
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Column  8  contains  a  “1”  if  the  component  is  in  series  and  a  “2”  if  it  is  in  parallel. 

•  Column  11  contains  a  “1”  if  the  component  is  used  in  startup  only,  a  “2”  if  it  is  used 
during  run  only,  and  a  “3”  if  it  is  used  for  both  phases. 

•  Column  14  contains  the  distribution  codes: 

1  =  exponential 

2  =  normal 

3  =  lognormal 

4  =  probability  of  success 

‘  Columns  15—21  contain  the  exponential  failure  rate  X  10* ,  or  the  mean  time  to 
failure  (normal  or  lognormal),  or  the  probability  of  the  component’s  success. 

•  Colunms  22—28  contain  the  standard  deviation  (normal  or  lognormal)  or  are  set  to  0. 

•  Columns  29—35  contain  the  time  the  component  has  already  operated  if  normal  or 
lognormal  is  used  or  are  otherwise  set  to  0. 

Columns  36—42  contain  K  factor  number  1. 

•  Columns  43—43  contain  K  factor  number  2. 

•  Columns  50—56  contain  K  factor  number  3. 

•  Columns  57—63  contain  K  factor  number  4. 

Note  1 :  The  last  seven  fields  must  be  punched  with  a  decimal  point,  and  no  fields  may 
overlap. 

Note  2:  The  values  associated  with  iognurmally  distributed  variables  must  be  in  terms  of 
natural  logarithms. 

The  prediction  program  is  shown  in  Figure  B— 2. 
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I  1  D1MKM5I0M  1SPC  75*2> *  IDS T<  7b)  *  VAR(  75*  7)  *  1<20)  *  I  (JPC20) 

1  •  >  FIL EMAM E  F i< IJ A TA * Xi ; DA  TA *  Y K UA TA »  Z  RUA TA 

•  A  K  EA  L)  I  *  N  * K 

i*  1  F0KMAK2I2) 

50  READ  2i(T(I)>Ul>ri) 

60  2  F0KMAT<10F5.0> 

70  READ  3*<Ii3P(l)*l  =  l*M> 

Ml  3  FORMAT (2012) 

90  r\EAU<  "YKUA  TA"*  4)  <  1  SP  Cl  »  1  )  *  1 SP  (  1 * 2  )  *  1  US  T  (  1  >  *  (  VAkt  I *  J  )  *  J=  I  #  7>»  I*  I  *N> 
100  4  Fi)KMATCSX#313»7F7.2> 

110  i1  h  1  MT !  "PHASE  AMO  SYSTEM  RELIABILITIES*  AMD  PHASE  0PER.  TIME*’ 

120  S=|.0 

13u  DO  10  J=1,M 

1  A!  -  psl.O 

ISO  x.<i  =  .l 

|A‘i  •  0 

170  i-i  =  Xf! 

l*<i  do  y. oo  1  =  1  *M 

19. »  IK  (.1-2  4-10  I  7* I H *  1  7 

on  17  1 1*  <  l  SP  (  I  *  2  >  -  2  )  19*200*19 

210  |{  lF<lSl‘<i»2>-2)  200*19*19 

220  19  i J=10P< J>+3 

23i>  II=IDSr<I> 

y.&n  OO  TO  (2  1  *  22*  22*  2  A)  *  1 1 

OSI  ;:1  X.l=VAi;U*l  >/IOOOOOU .O+VAAt I  *  1 J) 

2f.o  i*KU=<KXI>C-Xi1*T<  J)  )  > 

:•"/■)  TO  20 

i'.nu  rv.  X  =VAi;CI*l  >  KVAi,<l*iJ) 

29  O  r  1  MF.=  T  <  J )  +  VAR  1 1 «  3  ) 

30U  IFCII-2)  2S*2b»23 

310  25  Y=<T1ME-X0)/VAR<1,2) 

020  00  10  26 

330  23  Y=<ALOGU  1ME>-XM>/VAKCI*2>  . 

340  26  t’.,0  =  o  •  s  +  ( 1  .O+CI  *0“  EXP(  -0  •  63662*Y*Y  >  >**0  •  S> 

350  l F  <  Y  >  20*20 *  2d 

360  2R  PKO= 1 • O-PRD 

370 

3i-;o  Cj  TO  20 

39  1  24  IJR  J  =  VARC1,1  ) 

395  20  IFCISPU*!  >-!  >  27*27*29 

39  7  2  7  r'  =  P*i-*RiJ 

Ay t  03  TO  200 

40  3  29  r'=P+  ( 2«  O+PK0-PR0*PR0 > 

405  200  UOMTIMUF. 

407  S=S*P 

410  PRINT  9*  P*S»T(J> 

420  9  FQRMATOEI  5.3> 

430  10  C0MTI.MUE 

440  PRIMTt  "SYSTEM  RELIABILITY" 

450  PRIMT  «»S 

460  H  FORMAT C El  5. H> 

470  STOP 

4*10  E>IU 


Figure  B-2.  PREDICTION  PROGRAM 


